DNS resolv doesn't work as expected

[jiramares]

I am using latest commit (merge of gh-57-intranet-dns branch).

I have following settings in project (file .sandcat/settings.json) and there is no file .sandcat/settings.local.json):

{
  "network": [
    {
      "action": "allow",
      "host": "*",
      "method": "GET"
    }
  ]
}

So from mine point of view any DNS resolv is enabled.

We have internet and intranet domain. Both are specified in search domains on host computer (mine computer). Mine local /etc/resolv.conf:

nameserver 127.0.0.53
options edns0 trust-ad
search internet_domain.cz intranet_domain.cz

You configure dnsmasq following way (no dns server specification in any settings.json - standard docker resolver uses lokally specified DNS -> so it should work if routed to docker resolver):

Jun  2 11:24:09 dnsmasq[69]: using nameserver 127.0.0.11#53 for domain internet_domain.cz 
Jun  2 11:24:09 dnsmasq[69]: using nameserver 127.0.0.11#53 for domain intranet_domain.cz 
Jun  2 11:24:09 dnsmasq[69]: using nameserver 1.1.1.1#53
Jun  2 11:24:09 dnsmasq[69]: using nameserver 8.8.8.8#53

And this configuration doesn't behave as expected (specified in documentation). None of our servers is resolved. If I install nslookup into agent container I get:

1) 
nslookup www.seznam.cz
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   www.seznam.cz
Address: 77.75.77.222
Name:   www.seznam.cz
Address: 77.75.79.222
Name:   www.seznam.cz
Address: 2a02:598:2::1222
Name:   www.seznam.cz
Address: 2a02:598:a::79:222

2) 
nslookup server.internet_domain.cz
;; Got SERVFAIL reply from 127.0.0.1
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find server.internet_domain.cz: SERVFAIL

3) 
nslookup server.intranet_domain.cz
;; Got SERVFAIL reply from 127.0.0.1
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find server.intranet_domain.cz: SERVFAIL

4) 
nslookup mitmproxy
;; Got SERVFAIL reply from 127.0.0.1
Server:         127.0.0.1
Address:        127.0.0.1#53

** server can't find mitmproxy.internet_domain.cz: SERVFAIL

Ad 1) I am looking public internet server - it works - we enabled any lookup so it is okay.

Ad 2) Our own internet server doesn't work because the internet_domain.cz is specified in dns lookup (if it is removed -> it works). This resolv doesn't need our internal DNS server because it is public server. So forwarding lookup domains to 127.0.0.11 causes it doesn't work.

Ad 3) Our intranet server doesn't work because the intranet_domain.cz is specified in dns lookup. And this traffic is in dnsmasq forwarded to 127.0.0.11 that should work and should go via our internal DNS servers.

Ad 4) Doesn't work - how to configure container to reach it.

Finally I have installed in compose-all.yml ubuntu server and tried nslookup from it and all resolves works. It means:

a) the docker resolve can resolv the name of other container (example 4)
b) the docker resolve goes via our internal dns server configured on mine host so we don't need anything extra to resolv intranet servers (example 3)
c) the docker resolv can resolv our and even common public server (example 1 & 2)

From mine point of view is dnsmasq misconfigured. The resolver '127.0.0.11` doesn't resolv anything and I don't know. Don't know how to force it to resolve something.

[jiramares]

I looks like I know why it is happening. In configuration of dnsmasq you forward *.internet_domain.cz and *.intranet_domain.cz to docker internal DNS resolver (127.0.0.11#53). But in wg-client configuration we have:

services:
  wg-client:
     ...
    # DNS exfiltration sink for Docker's embedded resolver at 127.0.0.11.
    # Sibling-container names are still resolved locally by the embedded DNS;
    # any other name under the compose project's search domain (e.g. an
    # attacker-crafted `<payload>.<project>_default`) gets forwarded by the
    # daemon to this address, which is unroutable per RFC 5737 (TEST-NET-1)
    # and so fails fast without ever leaving the host. Closes the bypass that
    # would otherwise route such queries to the host's upstream resolver,
    # invisible to mitmproxy.
    dns:
      - 192.0.2.1

Therefore any requests of mine are not resolved. Any container name is appended with lookup domain (intranet_domain.cz) therefore we doesn't resolve even the container name.

[adamw]

Now, how to fix this :) I assume you have specified your dns server in .sandcat/settings.json? E.g. { "dns_servers": ["10.250.0.1"] }

[jiramares]

Problem

Prerequisites

1. we want allow DNS requests to only specified dns names (allowed in settings.json - do not allow DNS questions to any domain because we need DNS exfiltration protection)
2. we want to resolve the sibling containers
3. we want to allow resolve the intranet names

Description

We need docker resolver. By default it is configured well (know local dns servers) but the overriden dns in wg-client (dns server IP is 192.0.2.1) causes that docker resolver can only resolve sibling containers (any other names are not resolved). I haven't changed this (but I have bad feeling about this configuration).

Therefore we need local DNS servers to resolve intranet names (and also the internet).

Solution

Local DNS servers

Specify dns_servers in settings.json to let the dnsmasq how to resolve intranet names.

Do not allow any DNS lookup

Not specify in projects .sandcat/settings.json that GET requests are allowed to everywhere (remove following content):

{
   "action": "allow",
   "host": "*",
   "method": "GET"
}

If we allow any DNS lookup we are not protected against DNS exfiltration.

Search domain from host

Ignore search domain from /etc/resolv.conf on host machine. At the moment it is passed into agent container (using this volume - wg-runtime:/run/sandcat:ro - it is generated in wg-client-init.sh). I completely ignore any search domain and the file looks like:

nameserver 127.0.0.1

This causes when looking up mitmproxy it stays 'mitmproxy(and notmitmproxy.intranet_domain.cz`). And it forces us to fully specify DNS name in container.

Wrong using docker DNS

There is default docker DNS listening on 127.0.0.11 that is in wg-client configured the way I don't understand well and depends whether wants to keep it. I understand that this DNS resolves only the container names and everything else ends on 192.0.2.1 - it means no resolution.

Therefore we have to use this DNS as fallback with docker names and everything else we want to go to hell (resolve error). Absolutely it cannot be used to resolve intranet names (by search domain) as it is configured at the moment.

Right dnsmasq configuration

There are some mistakes in dnsmasq configuration:

1. domain-needed - this causes that mitmproxy name is not resolved even though we remove search domain and want to resolv just mitmproxy
2. don't forward anything from search domain to 127.0.0.11 because it doesn't resolve it (lines server=/intranet_domain.cz/127.0.0.11)
3. from settings.json build list of domains you need to resolve (eg. anthropic.com, claude.ai, claude.com, server.intranet_domain.cz, repo1.maven.org) and we need this names (domains) to be forwarded to local DNS names. For each domain and each DNS server generate line server=/domain/dns_server/ (I made this manually not by code - we have to add it into - mitmproxy-config:/mitmproxy-config:ro volume in wg-client)
4. fallback is to docker resolver (resolves container name or gets error) - server=127.0.0.11

So my dnsmasg configuration looks:

# Auto-generated by wg-client-init.sh — do not edit.
no-resolv
no-hosts
listen-address=127.0.0.1
bind-interfaces
log-facility=-
cache-size=1000
bogus-priv
server=/anthropic.com/local.dns.server.ip1
server=/anthropic.com/local.dns.server.ip2
server=/claude.ai/local.dns.server.ip1
server=/claude.ai/local.dns.server.ip2
server=/claude.com/local.dns.server.ip1
server=/claude.com/local.dns.server.ip2
server=/server.intranet_domain.cz/local.dns.server.ip1
server=/server.intranet_domain.cz/local.dns.server.ip2
server=/repo1.maven.org/local.dns.server.ip1
server=/repo1.maven.org/local.dns.server.ip2

server=127.0.0.11

Implementation

I haven't changed anything in mitmproxy source code but it is necessary to create there the list of domain we allow to resolve. I think we don't need any DNS requests filtration there at all. Everything is in dnsmasq configuration.

And I only changed wg-client-init.sh where:

• remove searched domain from write_resolv_conf
• read searchable domains from mitmproxy
• change write_dnsmasq_conf to write right configuration

Alternative solutions

We can also go another way that I haven't tested. We can just use docker DNS resolver that works very well and only use dnsmasq to filter dns requests. It means that we doesn't need to specify dns servers in settings.json and not modify dns in wg-client compose file configuration.

Futher we probably doesn't need dnsmasq because the mitmproxy is capable to filter dns requests for us but I haven't check it. From mine point of view it is the simplest way. Permitted domains are in mitmproxy (processes the settings.json). We doesn't modify dns resolution in wg-client. But don't know how to forward dns lookup from agent container to wg-client (maybe it is enough to say server=127.0.0.11 in /etc/resolv.conf).

Conclusion

I thing the main problem was in misunderstanding how we need the DNS to behave. If we clarify what we needs then the configuration is straightforward.

Question is whether to go another suggested way (I thing the solutions is more simple therefore better) or stay with this one (described here)

[jiramares]

Try to go without dnsmasq

I tried to check the alternative solution to use docker DNS 127.0.0.11. I though we can fully forget to dnsmasq.

We use this configuration when in docker compose for wg-client doesn't specify dns: 192.0.2.1. It means that the docker resolver for wg-client works as normal docker resolver (resolve any container name and if it not the container go to the host to resolve by host machine).

Need to change /etc/resolv.conf for agent container (created in wg-client-init.sh in write_resolv_conf) the nameserver from 127.0.0.1 (the dnsmasq instance) to 127.0.0.11 (docker resolve).

No we resolve anything and has no control over it (because the DNS request are not going through mitmproxy - go directly to docker and then to host - if necessary).

So this is not what we want.

Filtering in dnsmasq

I realized that forwarding directly to dns resolver (127.0.0.11) means we cannot filter dns traffic in mitmproxy. The only possibility is filter inside dnsmasq.

So we have to create configuration as suggested in my former solution post that filtering is done by dnsmasq via its configuration. For example:

# Auto-generated by wg-client-init.sh — do not edit.
no-resolv
no-hosts
listen-address=127.0.0.1
bind-interfaces
log-facility=-
cache-size=1000
bogus-priv
server=/anthropic.com/127.0.0.11
server=/claude.ai/127.0.0.11
server=/claude.com/127.0.0.11
server=/server.intranet_domain.cz/127.0.0.11
server=/repo1.maven.org/127.0.0.11
server=//127.0.0.11
server=192.0.2.1

That perfoms the dns filtering for us. The // rule resolves containers and last fallback rule returns always refused.

Conclusion

This solution works well is little bit easier (from mine point of view) then the previous one but have one huge disadvantage. Debuging when something doesn't go well. You don't have any events, messages, logs in mitmproxy about dns resolution . Therefore you don't know where the agent tries to resolve. And you have to look it up in dnsmasq log that is not created (of cource you can create one by little change of the conf file)

From mine point of view it is better to enhance former solution with external dns servers to see everything in mitmproxy and filter it there.

[jiramares]

After learning everything I suggest keeping actual solution (with light modification in ignoring search domains and not allowing get to everywhere) but modify the dnsmasq configuration:

# Auto-generated by wg-client-init.sh — do not edit.
no-resolv
no-hosts
listen-address=127.0.0.1
bind-interfaces
log-facility=-
cache-size=1000
bogus-priv
server=//127.0.0.11
server=local.dns.server.ip1
server=local.dns.server.ip2

It means all names without dot try to resolve by docker. If the name is not container name there is fallback (configured in wg-client) to 192.0.2.1 that resolves nothing.

And fallback for dnsmasq are the local dns servers (if specified) or internet default dns servers. Both goes through mitmproxy and it filters allowed traffic.

The dnsmasq config is simple, we need only to pass the dns servers (local or defaul) nothing more. No filtering there. And we strictly filter in mitmproxy.

[jiramares]

I have done the changes that works for me very well. The changes are only in 2 files.

cli/templates/settings.json

Do not allow (by default) any get (therfore any DNS lookup) because you are not protected agains DNS exfiltration anymore.

--- a/cli/templates/settings.json
+++ b/cli/templates/settings.json
@@ -1,9 +1 @@
-{
-  "network": [
-    {
-      "action": "allow",
-      "host": "*",
-      "method": "GET"
-    }
-  ]
-}
+{ "network": [] }

cli/templates/devcontainer/sandcat/scripts/wg-client-init.sh

Here is more changes:

• don't need to read search domains anymore
• modify dnsmasq configuration
• modify resolv.conf file

@@ -58,17 +58,6 @@ read_upstream_nameservers() {
     printf '%s\n' "${lines[@]}"
 }
 
-# Print the search domains found in $1 (a resolv.conf-format file), one per
-# line. Used to capture the Docker compose project's default network domain
-# from the original resolv.conf so we can route those queries to Docker's
-# embedded DNS at 127.0.0.11.
-extract_search_domains() {
-    local resolv_conf="$1"
-    [[ -f "$resolv_conf" ]] || return 0
-    awk '/^[[:space:]]*search[[:space:]]/ { for (i=2; i<=NF; i++) print $i }' \
-        "$resolv_conf"
-}
-
 # Write a dnsmasq config that splits DNS:
 #  - queries under any of the given search domains (the Docker compose project
 #    network) are forwarded to Docker's embedded DNS at 127.0.0.11,
@@ -91,16 +80,10 @@ write_dnsmasq_conf() {
         echo "bind-interfaces"
         echo "log-facility=-"
         echo "cache-size=1000"
-        # Drop dotless and RFC1918-reverse queries instead of forwarding them.
-        # Sibling-container resolution relies on libc expanding bare names via
-        # the search domain into FQDNs; any single-label query that still
-        # reaches dnsmasq has bypassed that path and shouldn't leak upstream.
-        echo "domain-needed"
         echo "bogus-priv"
-        local d
-        for d in "$@"; do
-            printf 'server=/%s/127.0.0.11\n' "$d"
-        done
+        # Any name without dot forward to docker dns that is configued to 
+        # resolve container names or fail
+        echo "server=//127.0.0.11"
         local ns
         while IFS= read -r ns; do
             printf 'server=%s\n' "$ns"
@@ -109,9 +92,6 @@ write_dnsmasq_conf() {
 }
 
 # Write a resolv.conf that routes all queries through the local dnsmasq.
-# Search domains are preserved so that bare hostnames (e.g. another compose
-# service) get expanded by the libc resolver and routed to 127.0.0.11 by
-# dnsmasq's `server=/<search>/127.0.0.11` rules.
 #
 # `options ndots:0` from the Docker-supplied resolv.conf is intentionally NOT
 # preserved — it would defeat the search-domain expansion path that lets
@@ -119,15 +99,8 @@ write_dnsmasq_conf() {
 #
 # Args:
 #   $1     - path to resolv.conf to overwrite
-#   $2..$N - search domains preserved from the original file (may be empty)
 write_resolv_conf() {
-    local resolv_conf="$1"
-    shift
-
-    {
-        echo "nameserver 127.0.0.1"
-        if [[ "$#" -gt 0 ]]; then echo "search $*"; fi
-    } > "$resolv_conf"
+    echo "nameserver 127.0.0.1" > "$1"
 }
 
 main() {
@@ -142,13 +115,6 @@ main() {
         "Timed out waiting for mitmproxy wireguard.conf" \
         test -f "$WG_JSON"
 
-    # ── Snapshot search domains BEFORE we overwrite resolv.conf ────────────────
-    # Docker populates the container's resolv.conf with the compose project's
-    # default network as a search domain. We preserve it so single-label
-    # sibling-container lookups still work after dnsmasq takes over.
-    local search_domains=()
-    mapfile -t search_domains < <(extract_search_domains /etc/resolv.conf)
-
     # ── Derive WireGuard keys ───────────────────────────────────────────────────
     # mitmproxy stores its WireGuard key pairs as JSON:
     #   {"server_key": "<server-private>", "client_key": "<client-private>"}
@@ -259,7 +225,7 @@ main() {
     # Outbound from dnsmasq stays inside the kill-switch installed above:
     #   - 127.0.0.11 traffic uses the lo interface (ACCEPT-ed),
     #   - upstream queries go via wg0 (ACCEPT-ed).
-    write_dnsmasq_conf "$DNS_CONF" "$DNSMASQ_CONF" "${search_domains[@]}"
+    write_dnsmasq_conf "$DNS_CONF" "$DNSMASQ_CONF"
     dnsmasq --conf-file="$DNSMASQ_CONF"
 
     # dnsmasq daemonizes after parsing its config; verify it actually bound
@@ -269,12 +235,12 @@ main() {
         "dnsmasq did not start listening on 127.0.0.1:53" \
         dnsmasq-ready
 
-    write_resolv_conf /etc/resolv.conf "${search_domains[@]}"
+    write_resolv_conf /etc/resolv.conf
 
     # Publish the same resolv.conf for sibling containers to copy from.
     # See SHARED_RESOLV_CONF declaration for why this is necessary.
     mkdir -p "$(dirname "$SHARED_RESOLV_CONF")"
-    write_resolv_conf "$SHARED_RESOLV_CONF" "${search_domains[@]}"
+    write_resolv_conf "$SHARED_RESOLV_CONF"
 
     # Signal readiness to containers waiting on the healthcheck.
     touch /tmp/wg-ready

[jiramares]

I can also create PR if you prefer? Or you are thinking about the solution?